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Abstract 

Crime  pattern  analysis  (CPA)  is  the  process  of  analytical  reasoning  facilitated  by 
an  understanding  about  the  nature  of  an  underlying  spatial  framework  that  generates 
crime.  For  example,  law  enforcement  agencies  may  seek  to  identify  regions  of  sudden 
increase  in  crime  activity,  namely,  crime  outbreaks.  Many  analytical  tools  facilitate  this 
reasoning  process  by  providing  support  for  techniques  such  as  hotspot  analysis.  However, 
in  practice,  police  departments  are  desirous  of  scalable  tools  for  existing  techniques  and 
new  insights  including,  interaction  between  different  crime  types.  Identifying  new 
insights  using  scalable  tools  may  help  reduce  the  human  effort  that  may  be  required  in 
CPA. 

Formally,  given  a  spatial  crime  dataset  and  other  infonnation  familiar  to  law 
enforcement  agencies,  the  CPA  process  identifies  interesting,  potentially  useful  and 
previously  unknown  crime  patterns.  For  example,  analysis  of  an  urban  crime  dataset 
might  reveal  that  downtown  bars  frequently  lead  to  assaults  just  after  bar  closing. 
However,  CPA  is  challenging  due  to:  (a)  the  large  size  of  crime  datasets,  and  (b)  a 
potentially  large  collection  of  interesting  crime  patterns.  This  chapter  explores,  spatial 
frequent  pattern  mining  (SFPM),  which  is  a  spatial  data  driven  approach  for  CPA  and 
describes  SFPM  in  the  context  of  one  type  of  CPA,  outbreak  detection.  We  present  a  case 
study  to  discover  interesting,  useful  and  non-trivial  crime  outbreaks  in  a  dataset  from 
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Lincoln,  NE.  A  review  of  emerging  trends  and  new  research  needs  in  CPA  methods  for 
outbreak  detection  is  also  presented. 

1  Introduction 

Crime  pattern  analysis  (CPA)  is  a  key  step  employed  by  law  enforcement  and 
criminal  justice  agencies  towards  understanding  the  spatial  environment  that  generates 
crime  patterns  [18].  For  example,  the  analysis  of  crime  datasets  with  multiple  crime  types 
may  reveal  sudden  increase  in  the  activity  of  a  subset  of  crime  types  in  certain  areas.  This 
understanding  provides  insight  into  predicting  future  crime  incidents  and  mitigates 
existing  crimes  [8,  37,  38]. 

The  importance  of  CPA  is  clearly  evident  in  the  growth  of  spatial  crime  reports 
and  other  spatial  information  known  to  law  enforcement.  Rapid  collection  and  archival  of 
crime  reports  coupled  with  the  growing  analytical  needs  of  law  enforcement  has  given 
rise  to  a  variety  of  tools  including  CrimeStat  [43],  ArcGIS  10  Spatial  Statistics  Toolbox 
[2],  GeoDa  [6],  Rigel  [64],  SANET  [56],  SatScan  [53]  etc. 

However,  the  growing  needs  of  law  enforcement  stresses  scalable  ways  to 
generate  meaningful  crime  patterns  that  may  lead  to  hypotheses  regarding  the  nature  of 
crime  as  opposed  to  human  driven  enumeration  of  all  possible  hypotheses.  For  example, 
in  a  typical  crime  dataset  containing  40  different  crime  types,  there  may  be  over  240 
different  patterns  of  association  between  different  types.  Enumerating  all  these  patterns 
manually  would  be  an  arduous  task  even  for  trained  analysts.  Many  police  departments 
aim  to  accomplish  crime  mitigation  and  crime  prevention  with  very  few  resources. 
However,  the  growth  in  the  size  and  volume  of  crime  datasets  poses  serious  challenges. 
Hence,  there  is  a  growing  need  for  scalable  tools  that  can  assist  trained  analysts  and 
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accomplish  law  enforcement  goals  with  minimal  resource  allocation.  CPA  helps  law 
enforcement  planners  accomplish  this  goal  by  identifying  interesting,  potentially  useful, 
and  non-trivial  spatial  patterns  including,  regions  of  sudden  increase  in  crime  activity 
[75,76,77,78,79,81],  frequent  co-occurrence  of  crime  types  around  features  such  as  bars 
[35,  48-50]  and  crime  prone  streets  [22,  58]. 

1.1  Existing  Research  and  Our  Contributions 

Similar  to  the  evolution  in  scientific  methodology  [34],  CPA  has  witnessed  a 
massive  growth  in  the  number  and  variety  of  approaches  to  identify  and  interpret  patterns 
of  crime  [23].  Methodological  advancements  in  CPA  include,  empirical  approaches 
[31,46,60],  criminological  theories  that  interpret  the  spatial  aspects  of  crime 
[5,7,10,11,12,21,23,25,26,32,33],  offender-profiling  techniques  to  characterize  the  spatial 
habitat  of  offenders  [41,44,57,64,65,28,13,14,15,16,17]  and  crime  hotspot  detection 
techniques  [3,5,6,27,  40,  42,51,54,56,59,61,62,63,68,69]  that  can  extract  concentrations  of 
a  single  crime  type. 

A  special  class  of  crime  patterns  is  crime  outbreak.  Crime  outbreaks  are  subsets  of 
a  spatial  framework  with  significantly  high  level  of  crime  activity  involving  one  or  more 
related  crime  types.  The  level  of  significance  in  a  crime  outbreak  is  calculated  based  on  a 
ratio  between  observed  count  within  a  region  and  the  count  expected  via  a  user  specified 
probability  model  [53,61,76,77,78,79]  as  opposed  to  simple  counts  or  local  autocorrelation 
statistics  that  are  used  in  traditional  hotspot  detection  methods.  Outbreak  detection  has 
been  a  explored  in  Spatial  epidemiology  via  statistical  models  to  compute  the  likelihood  of 
different  disease  types  in  being  a  part  of  any  disease  outbreak  [75].  Figure  1  shows  a 
classification  of  different  CPA  approaches  to  outbreak  detection.  As  shown  in  this  figure, 
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CPA  methods  for  outbreak  detection  can  be  classified  into  two  broad  categories.  The  left 
category  corresponds  to  techniques  that  are  designed  to  analyze  crime  outbreaks  in  a 
single  crime  type  or  entire  crime  datasets  without  any  type  level  stratification.  These 
techniques  include,  hotspot  analysis  methods  for  detecting  crime  hotspots  of  points 
[40,42,43,52]  areas  or  zones  [5,6,54]  and  street  network  subsets  [7,22,56,58],  The 
rationale  for  this  classification  of  crime  hotspots  is  based  on  the  type  of  hotspot  map  that 
is  produced  [27],  However,  in  most  crime  analysis  scenarios,  an  understanding  of  the  co¬ 
occurrence  of  different  crime  types  and  spatial  features  such  as  bars  may  reveal  interesting 
patterns  pertaining  to  geographical  locality  of  certain  crime  types  [27].  Existing 
techniques  in  hotspot  analysis  are  not  designed  to  handle  this  scenario. 


CPA  methods  for  Oubreak 

detection 

Single  crime  type 

I 

Multiple  crime  types 

1 

▼ 

*  Point  Hotspots 

V 

Spatial  frequent 

*  Area  hotspots 

pattern  mining 

*  Network  Hotspots 

(Our  Focus) 

Figure  1:  Classification  of  CPA  methods  for  Outbreak  detection 

In  contrast,  the  proposed  spatial  frequent  pattern  mining  (SFPM)  is  designed  for 


analyzing  patterns  involving  multiple  crime  types  and  their  associations  with  different 
features  such  as  bars.  In  this  chapter,  we  describe  one  class  of  SFPM  methods,  namely, 
regionally  frequent  crime  patterns  (RFCP)  that  are  spatial  representations  of  crime 
outbreaks  involving  multiple  crime  types.  Formally,  RFCPs  are  subsets  of  different 
crime  types  that  co-occur  frequently  in  certain  areas  of  a  spatial  framework.  In  order  to 
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quantify  the  significance  of  a  multi-type  crime  outbreak,  we  make  use  of  the  Multinomial 
scan  statistic  [75].  The  multinomial  scan  statistic  extracts  significant  crime  types  that  may 
be  involved  in  one  or  more  outbreaks  via  a  maximum  likelihood  ratio  test  statistic.  Based 
on  the  significant  crime  types  identified,  the  RFCP  discovery  process  identifies  spatial 
subsets  of  these  significant  crime  types  and  quantifies  crime  outbreaks  using  a  regional 
conditional  probability  (RCP)  measure. 

This  chapter  makes  the  following  contributions: 

(a)  We  define  spatial  frequent  pattern  mining  (SFPM)  and  illustrate  it  using  one  class 
of  methods  namely,  regionally  frequent  crime  patterns  (RFCPs). 

(b)  We  describe  the  methodology  for  discovering  crime  outbreaks  represented  as 
RFCPs  by  making  use  of  the  multinomial  scan  statistic.  We  illustrate  this 
methodology  with  a  case  study  using  a  crime  dataset  from  Lincoln,  Nebraska  and 
present  discovered  crime  outbreaks  involving  multiple  crime  types. 

(c)  We  describe  emerging  trends  in  spatio-temporal  frequent  pattern  mining  in  the 
context  of  space-time  outbreak  detection. 

(d)  We  outline  research  needs  including,  methodological  advancements  to  account  for 
special  semantics  of  spatio-temporal  data  and  key  aspects  urban  crime  scenarios, 
including  analyzing  crime  distributions  along  street  networks. 

1.2  Scope  and  Organization 

This  chapter  provides  an  overview  of  spatial  frequent  pattern  mining  and 
outlines  its  capabilities  for  aiding  in  law  enforcement  with  the  primary  intent  of  reducing 
human  effort  that  may  be  required  in  crime  pattern  analysis.  Hence,  this  chapter  does  not 
focus  on  presenting  computational  performance  evaluation.  There  are  a  number  of  crime 
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pattern  analysis  methods  in  criminology.  However,  this  chapter  just  focuses  on  outbreak 
detection  in  crime  data. 

The  chapter  is  organized  as  follows:  (a)  Section  2  reviews  some  basic  concepts 
including,  defining  spatial  frequent  pattern  mining  and  describes  regionally  frequent 
crime  pattern  (RFCP)  with  examples,  (b)  Section  3  describes  our  methodology  to 
discover  crime  outbreaks  via  RFCP  mining,  (c)  Section  4  describes  some  emerging  trends 
in  spatio-temporal  frequent  pattern  mining,  and  (d)  Section  5  outlines  some  research 
needs  including,  new  methodological  advancements  in  crime  pattern  analysis  for 
outbreak  detection. 

2  Basic  Concepts 

This  section  reviews  some  concepts  related  to  spatial  frequent  pattern  mining 
(SFPM)  and  defines  the  crime  outbreak  detection  problem. 

Spatial  frequent  pattern  mining  (SFPM)  is  the  process  of  discovering 
interesting,  useful  and  non-trivial  patterns  from  spatial  datasets.  Figure  2  shows  a  typical 
SFPM  process  that  is  based  on  the  crime  datasets  collected  and  archived  by  law 
enforcement  as  the  basis.  The  SFPM  process  usually  begins  with  knowledge  of 
criminological  theories  from  environmental  criminology.  Based  on  these  theories, 
analysts  pose  certain  questions  on  the  data.  Some  questions  would  be:  Why  do  downtown 
bars  often  lead  to  assaults  crimes  but  bars  in  other  regions  seldom  do  so?  Is  it  regional 
differences  in  geographic  concentration?  Are  there  regional  differences  in  patron 
demography  or  crowd  density?  Are  there  policy  differences  in  screening,  bouncing, 
policing? 
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Based  on  these  questions,  the  SFPM  process  involves  understanding  the  available 
data  via  suitable  interpretation  models,  including  fitting  of  well  known  distributions, 
specifying  suitable  representations  of  observed  crime  patterns,  understanding  of  possible 
neighborhood  effects.  A  key  outcome  of  the  data  understanding  step  in  SFPM  is  the 
knowledge  of  spatial  neighborhoods  that  may  be  useful  to  explore  possible  relationships 
between  individual  data  entities  such  as  crime  reports,  police  districts,  crime  prone  streets 
etc.  A  spatial  neighborhood  is  a  collection  of  related  spatial  entities  such  as  crime 
reports.  A  spatial  neighborhood  is  usually  specified  by  means  of  a  spatial  neighbor 
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relation.  A  spatial  neighbor  relation  can  be  topological  or  distance  based  [66]. 


(a)  Illustrative  crime  reports 
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Figure  3:  Spatial  neighborhood  matrix  and  spatial  neighborhood  graph 


In  most  crime  analysis  applications  involving  crime  reports,  the  most  common 
type  of  neighbor  relation  is  a  distance-based  relation.  The  application  of  a  spatial 
neighbor  relation  on  a  collection  of  crime  reports  produces  a  spatial  neighborhood 
matrix,  commonly  referred  to  as  the  W-Matrix.  For  example,  Figure  3(a)  shows  an 
illustrative  crime  report  dataset  showing  different  crime  reports  represented  as  circles 
with  labels  Nl,  N2  etc.  Application  of  a  neighbor  relation  based  on  a  distance  threshold 
(e.g.,  1  mile,  2  mile  etc.)  produces  a  spatial  neighborhood  matrix  as  shown  in  Figure  3(b). 
The  matrix  in  this  figure  consists  of  Os  or  Is  to  represent  the  absence  or  presence  of  a 
neighbor  relationship.  Figure  3(c)  shows  an  alternative  representation  of  the  W-Matrix 
called  the  neighborhood  graph,  where  the  edges  represent  the  presence  of  a  neighbor 
relation  and  the  nodes  represent  the  crime  reports. 

Given  spatial  crime  data,  neighbor  relationships,  environmental  criminology 
theories  and  other  inputs  known  to  law  enforcement,  SFPM  employs  several  techniques 
to  identify  interesting,  useful  and  non-trivial  crime  patterns.  One  such  technique  is 
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Regionally  frequent  crime  pattern  (RFCP)  discovery. 


RFCPs  represent  collections  of  spatial  features  and  crime  types  frequently 
associated  with  each  other  at  certain  localities.  For  example,  the  RFCP,  <(Bar,  Assaults), 
Downtown  >  indicates  that  a  frequent  pattern  involving  assaults  and  bars  is  often 
localized  in  downtown  regions.  Given  feature  types2  (e.g.,  Bars),  crime  types  and  their 
geo-located  instances,  along  with  a  spatial  neighborhood  size  and  a  likelihood  threshold, 
the  RFCP  discovery  process  finds  all  interesting  RFCPs.  For  example,  Figure  4(a)  shows 
an  illustrative  crime  dataset  consisting  of  one  feature  type,  Bars,  and  two  crime  types, 
Assaults  and  Drunk  Driving.  Red  circles  represent  bars;  blue  triangles  represent  assaults, 
green  squares  represent  drunk  driving. 

Given  the  input  in  Figure  4(a),  the  RFCP  discovery  process  identifies  RFCPs  as 
shown  in  Figure  4(b).  In  the  Figure,  the  RFCPs  (shown)  correspond  to  the  collection 


Figure  4:  Illustrative  example  of  RFCP  (Best  viewed  in  color) 


2  For  brevity,  the  term  “feature  types"  and  “feature"  are  used  interchangeably  in  this  paper.  For  example, 
a  bar  feature  may  correspond  to  a  bar  feature  type  such  as  bar  closing  or  happy  hour,  etc.,  that  occurs  at  a 
bar  location 
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This  RFCP  is  represented  as  <{ABC},  Locality>  in  Figure  4(b).  The  locality  is 
shown  as  dotted  purple  polygons.  The  dotted  purple  polygons  represent  localities  where 
the  collection  of  crime  types  and  spatial  features,  {ABC}  may  be  frequent.  The  shaded 
orange  triangles  represent  individual  instances  of  the  collection  {ABC}.  In  Figure  4(b)  the 
localities  are  defined  based  on  the  convex  hull  of  related  crime  reports  and  spatial 
features.  One  may  also  choose  to  specify  these  localities  by  partitioning  the  spatial 
framework  via  quad  partitions  as  shown  in  Figure  4(c).  However,  such  a  scheme  may 
result  in  loss  of  information  about  spatial  relationships  at  the  boundary  of  such  a 
partition. 

The  number  adjoining  each  locality  in  Figure  4(b)  is  the  chance  that,  the 
collection  {ABC}  containing  instances  of  Bar  feature  can  be  observed  along  with 
instances  of  crimes  like  assault  or  drunk  driving.  This  chance  of  occurrence  can  be 
interpreted  as  a  local  fraction  of  instances  corresponding  to  a  crime  type  or  feature  type 
that  participates  in  a  collection  [35,  50].  A  collection  such  as  {ABC}  along  with  its 
observed  locality  may  be  considered  an  RFCP  if  the  chance  of  it  occurring  is  above  the 
user  specified  threshold.  The  local  fraction  of  instances  of  any  crime  type  participating  an 
RFCP  is  measured  using  a  Regional  conditional  probability  (RCP).  RCP  can  be 
defined  as  follows: 

^  #  instances  of  Crime  -  type  participating  in  RFCP 

RCP(Cnme  -  type, RFCP)  =  - ^ - - - - -  (1) 

#  instances  of  Crime  -  type  in  the  Dataset 

Since,  an  RFCP  is  a  collection  of  co-occurring  crime  types  in  the  vicinity  of  spatial 
features  like  bars,  quantifying  the  importance  of  an  RFCP  involves  accounting  for  the 
location  fraction  of  different  crime  types.  In  typical  crime  datasets,  80%  of  the  crime 
might  occur  in  20%  of  the  places.  Hence,  one  may  be  interested  in  particular  bars  that 
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may  be  responsible  for  a  large  number  of  crimes.  Hence,  the  actual  measure  that 
quantifies  the  interestingness  of  an  RFCP  is  the  lower  bound  on  the  regional 
conditional  probabilities  of  all  crime  types  and  features  that  participate  within  a  pattern. 
This  lower  bound  can  be  tenned  as  the  Regional  conditional  probability  index  (RCPI). 
This  measure  can  be  defined  as  follows: 

.  [  #  instances  of  Crime  -  type  participating  in  RFCP 

RCPI(RFCP)  =  mint - — - 

[  #  instances  of  Crime  -  type  in  Dataset 

The  min  term  in  (1)  represents  that  the  value  of  RCPI  is  the  least  RCP  of  all  crime 
types  or  features  within  a  RFCP.  For  example,  for  the  RFCP  in  Figure  4(b),  <{ABC}, 
L2>  contains  two  instances  of  Assault  represented  by  the  letter  A.  Since  there  are  4 
instances  of  Assault  in  the  dataset  shown  in  Figure  4(a),  the  RCP  of  A  within  the  RFCP 
<{ABC},  L2>  is  2/4.  That  is  the  local  fraction  of  Assault  within  the  RFCP  is  2/4,  which 
is  0.5.  This  implies  that  the  chance  of  witnessing  an  Assault  crime  within  the  locality  L2 
is  50%.  Similarly,  the  RCPs  for  Bar  feature  and  Drunk  Driving  arrests  represented  by  the 
letter  C  is  2/6  and  1/4  respectively.  Hence,  the  RCPI  of  the  RFCP,  <{ABC},  L2>  can  be 
computed  as  follows: 

RCPI(<  {ABC},L2  >)  =  min|^-,^,^J  =  ^  =  0.25 

The  value  0.25  is  the  degree  of  interestingness  of  the  RFCP  <{ABC},L2}  and 
represents  the  chance  that  the  entire  RFCP  may  occur  when  at  least  one  instance  of  any  of 
the  participating  crime  types  or  spatial  features  occur  within  locality  L2. 

Based  on  the  definition  RFCPs  and  their  interestingness,  a  crime  outbreak  of 
multiple  crime  types  may  be  viewed  as  an  RFCP,  which  has  participation  from  crime 
types  that  have  a  high  chance  of  participating  in  a  significant  cluster  within  the  spatial 
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framework.  Spatial  statistics  has  explored  a  popular  statistical,  the  multinomial  scan 
statistic  [75,81]  that  can  identify  crime  types  that  have  a  high  chance  of  participating  in 
significant  clusters  [75]. 

Based  on  the  above  definitions,  we  define  and  illustrate  crime  outbreak  detection 
as  an  analysis  problem  that  may  require  a  solution  using  SFPM  . 

2.1  Crime  outbreak  detection  and  Illustration 

In  this  section,  we  define  crime  outbreak  detection  as  a  data  analysis  problem  and 
illustrate  it  with  an  example  based  on  a  crime  dataset  from  Lincoln,  Nebraska  [1]. 
Formally,  crime  outbreak  detection  requires  the  following  inputs  specified  by  an  analyst: 

(a)  A  spatial  crime  dataset  with  a  collection  of  crime  types  and  others  spatial 
features  including,  bars,  schools  etc. 

(b)  Other  ancillary  information  known  to  law  enforcement,  spatial  neighborhoods 
and  appropriate  interestingness  threshold. 

Based  on  the  above  inputs,  the  goal  of  crime  outbreak  detection  is  to  report  a  collection 
of  RFCPs  with  RCPI  values  greater  than  interestingness  threshold  specified  by  the 
analyst.  However,  an  important  constraint  is  that,  the  identified  RFCPs  contain  crime 
types  and  spatial  features  are  highly  likely  to  be  a  part  of  a  significant  crime  outbreak. 

2.1.1  Problem  Illustration 

A  typical  input  to  crime  outbreak  detection  is  a  spatial  crime  dataset  that  may 
contain  two  or  more  crime  types  and  many  spatial  features  such  as  bars,  parks,  schools 
etc.  For  example,  Figure  5(a)  shows  a  crime  dataset  from  Lincoln,  Nebraska.[l]  This 
Figure  shows  bar  locations  as  red  circles  and  assault  crime  report  locations  as  black 
triangles.  The  Lincoln  crime  dataset  contains  about  40  different  aggregate  crime  types 
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with  an  average  of  5-6  sub-types  for  each  crime  type.  The  entire  dataset  corresponds  to 
the  years  1999-2007. The  assault  crime  reports  shown  in  Figure  5(a)  are  drawn  from  the 
year  2007.  Figure  5(b)  shows  the  count  of  assaults  within  a  1-mile  vicinity  of  bars  within 
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(a)  Bar  locations  and  Assault  incidents  in  2007  (b)  Probability  of  Bars  generating  crime  after 

bar  closing 

Figure  5:  Subset  of  Crime  data  from  Lincoln,  NE,  USA,  2007[l](Best  viewed  in  color) 


an  hour  after  bar  closing.  This  figure  reveals  that  bars  in  the  center  (downtown  Lincoln) 
have  a  high  chance  of  assaults  possibly  representing  an  outbreak.  Apart  from  crime 
reports,  spatial  features  and  spatial  neighborhoods,  analysts  are  also  required  to  specify 
thresholds  of  interestingness  to  discover  RFCPs(e.g.  0.25,  0.15,  0.001  etc.). 

Based  on  the  above  inputs,  the  proposed  SFPM  technique  (i.e.  RFCP  discovery) 
identifies  regions  where  different  crime  types  co-occur  in  the  vicinity  of  bars.  For 
example,  Figure  6(a-d)  shows  a  typical  output  of  the  analysis.  This  figure  shows  RFCPs 
corresponding  to  two  crime  types,  Assaults  and  Larceny  and  one  feature  type  Bar.  The 
RFCPs  containing  different  subsets  of  types  are  shown  as  blue  polygons. 
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(a)  RFCP  involving  Bars  and  Assaults  (b)  RFCP  involving  Bars  and  Larceny 


(c)  RFCP  involving  Larceny  and  Assaults  (d)  RFCP  involving  Assault,  Larceny 


and  Bars 

Legend 

■  Bar  Locations  #  Assault  A.  Larceny 
Figure  6:  Typical  output  of  crime  outbreak  detection  via  RFCP  discovery 

Figure  6(a)  shows  that  the  chance  of  witnessing  Assaults  in  the  vicinity  of 
downtown  bars  is  0.211  or  21.1  %.  Figure  6(b)  shows  that  the  chance  of  witnessing 
Larceny  crimes  in  the  vicinity  of  Downtown  bars  is  13.3%.  On  the  other  hand,  Figure 
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6(c)  shows  that  the  probability  of  finding  Larceny  crimes  around  the  site  of  an  assault  is 
higher  with  a  chance  of  47.6%  and  includes  both  the  downtown  area  and  the  northeast 
area  of  Lincoln,  NE.  Figure  6(d)  shows  an  RFCP  corresponding  to  Bars,  Assaults  and 
Larceny.  This  figure  shows  that  the  chance  of  finding  related  assaults  and  larceny  crimes 
in  the  vicinity  of  bars  in  downtown  is  increased  to  a  chance  of  0.201  or  20.1%  with 
respect  to  the  one  shown  in  Figure  6(b).  For  example,  Figure  6(b)  reports  a  lower  chance 
of  finding  a  larceny  in  the  vicinity  of  bars  downtown. 

An  important  in  constraint  in  Crime  outbreak  detection  via  RFCP  discoveiy  is 
that,  the  crime  types  participating  in  RFCPs  need  to  have  a  significantly  high  chance  of 
being  a  part  any  outbreak  within  an  RFCP. 

3  Crime  outbreak  detection:  Proposed  Approach 

In  this  section,  we  present  an  overview  of  crime  outbreak  detection  using  RFCP 
discovery  and  illustrate  it  via  a  case  study  from  the  Lincoln,  crime  dataset. 


Lincoln  Crime  dataset, 

- > 

Crime  types, 

Spatial  features  and 
Neighborhoods 


Crime  type  level 
counts  around  features 


Multinomial  Scan 

Statistic 

Visualize  Crime 
Outbreaks 


J 

Crime  types 
Darticipating  in 
significant  outbreaks 

i 

f 

Regionally 

Frequent 

Crimp  Pattprn 

Discovery 

Figure  7:  Overview  of  proposed  approach 
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Figure  7  shows  an  overview  of  the  proposed  approach  to  detect  crime  outbreaks. 
The  Lincoln  crime  dataset  from  the  year  2007  contains  crime  reports  with  multiple  crime 
types  and  several  feature  types  such  as  bars.  In  addition,  the  user  also  provides  a  sense  of 
spatial  neighborhood  (in  tenns  of  the  maximum  neighborhood  size,  typically  0.5  miles,  1 
mile  etc.).  Based  on  these  inputs,  the  first  stage,  computes  crime  type  level  counts  around 
each  spatial  feature. 

Once  these  counts  are  obtained,  we  make  use  of  the  Multinomial  scan  statistic  test 
implemented  in  the  SatScan  program  [53].  The  multinomial  scan  statistic  routine  in 
SatScan  computes  several  interesting  measures  including,  (a)  spatial  features  that  may  be 
a  part  of  significant  outbreaks,  (b)  Radius  of  a  possible  crime  outbreak  cluster  around 
each  feature  and  (c)  The  risk  of  occurrence  for  each  crime  type  within  each  outbreak 
cluster.  The  risk  value  for  each  crime  type  corresponds  to  the  ratio  of,  the  number  of 
cases  the  crime  type  within  the  radius  of  the  feature  to  the  number  of  cases  of  the  crime 
type  expected  to  occur  based  on  a  standard  multinomial  distribution.  In  our  analysis  we 
consider  only  crime  types  that  have  a  high  risk  of  occurring  within  the  neighborhood  of 
the  spatial  feature(i.e.  risk  >  1).  A  detailed  description  of  the  notion  of  risk  and  its 
interpretation  can  be  found  in  the  SatScan  manual  [53].  To  ensure  that  only  crime  types 
participating  in  statistically  significant  outbreak  are  highlighted,  SatScan  perfonns  Monte 
Carlo  simulation  and  computes  p-values.  Assuming  a  standard  significance  level  of  0.05, 
only  significant  spatial  features  and  crime  types  that  have  a  high-risk  level  within  their 
neighborhood  are  retained  after  the  multinomial  scan  statistic  test. 

The  results  of  the  multinomial  scan  statistic  test  include,  crime  types  that  may  be 
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involved  in  one  or  more  interesting  crime  outbreaks.  However,  it  is  still  important  to 
extract  the  actual  regions  of  these  outbreaks.  This  goal  accomplished  via  RFCP 
discovery.  The  RFCP  discovery  process  requires  other  inputs  including  interestingness 
thresholds,  and  spatial  neighborhood  infonnation.  Based  on  this  the  RFCP  process 
reports  all  interesting  RFCPs  of  crime  types  that  may  participate  in  one  or  more 
outbreaks.  Since  RFCPs  also  include  the  actual  location  of  the  crime  report,  they  provide 
an  enhanced  spatial  view  (e.g.  convex  polygon)  of  the  actual  outbreak  as  opposed  to  a 
simple  circular  neighborhood. 

3,1  Analysis  Results  on  Lincoln  Crime  dataset 

The  crime  dataset  from  Lincoln,  NE  in  the  year  2007  has  over  38000  crime 
reports  and  40  crime  types.  For  the  purpose  of  this  analysis,  bars  in  Lincoln  were  the  only 
spatial  features  included.  Lincoln  city  has  403  bars.  To  detennine  type  level  counts  in  the 
vicinity  of  each  bar,  we  used  a  spatial  neighborhood  based  on  a  distance  threshold  of  0.5 
miles.  This  step  is  similar  to  performing  an  overlay  operation  within  a  GIS.  However,  due 
to  a  large  number  of  crime  types,  the  overlay  operation  needs  to  be  performed  using  a 
specialized  spatial  database  [66]  with  indices  geometric  built  on  the  geometry  of  different 
crime  reports.  A  manual  task  of  perfonning  overlay  within  a  GIS  would  require 
enonnous  human  effort,  while  the  use  of  a  spatial  database  reduces  the  effort  and  time 
required  to  compute  type  level  counts  in  the  vicinity  of  each  bar  location. 

Type  level  counts  at  each  bar  location  and  the  co-ordinates  of  the  bars  were  then 
provided  as  input  to  the  multinomial  scan  statistic  routine  in  the  SatScan  program  [53]. 
The  multinomial  scan  statistic  requires  a  maximum  spatial  neighborhood  search  radius. 
We  used  the  same  search  radius  that  was  used  to  compute  the  type  level  counts,  i.e.  0.5 
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miles.  Based  on  these  inputs  SatScan  computes  the  multinomial  scan  statistic  for  each  bar 


location  and  performs  montecarlo  simulation  to  generate  p-values.  Only  bars  that  are  a 


part  of  significant  crime  outbreak  (i.e.  p-value  <=0.05)  were  chosen  for  further  analysis. 


Also,  for  each  bar  location,  SatScan,  computes  the  relative  risk  level  of  a  crime  type 


belonging  to  that  outbreak.  Each  crime  type  in  the  dataset  may  belong  to  one  or  more 


outbreaks  across  Lincoln.  The  number  of  outbreaks  for  each  crime  type  is  shown  in 


Figure  8.  SatScan  also  reports  a  radius  around  each  bar  location  to  provide  a  spatial 
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Figure  8:  Number  of  outbreaks  for  each  crime  type  in  Lincoln,  NE,  2007. 
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extent  for  the  possible  crime  outbreak.  Based  on  this  information,  one  can  visualize  the 
extent  and  location  of  crime  outbreaks  for  each  crime  type.  Figure  9  shows  the  location 
and  extent  of  possible  outbreaks  corresponding  to  two  crime  types,  namely,  vandalism 
and  alcohol  crimes  (  spatial  outbreaks  of  other  crime  types  are  shown  in  Appendix  I). In 
Figure  9,  the  black  asterisks  represent  the  location  of  bars  and  the  red  circles  represent 
possible  crime  outbreaks.  The  radius  of  the  circles  is  determined  by  multinomial  scan 
statistics. 


(a):  Vandalism  outbreaks 


(b):  Alcohol  outbreaks 


Figure  9:  Location  and  extent  of  crime  outbreaks  by  crime  type,  Lincoln,  NE,  2007 


However,  the  circles  shown  in  Figure  9,  provide  only  a  rough  estimate  of  the  outbreak 
because  they  do  not  take  into  the  actual  location  of  different  crime  types.  A  visual 
examination  of  Figures  9(a)  and  9(a)  reveals  that  vandalism  crime  outbreak  (Figure  9(a)) 
and  alcohol  crime  outbreaks  (Figure  9(b))  possibly  co-occur  at  the  center  of  Lincoln  (the 
cluster  of  bars  at  the  center).  To  identify  the  final  crime  outbreak  regions,  we  extract  all 
crime  types  from  the  dataset  that  have  a  high  risk  of  occurrence  in  or  more  outbreaks 
(Due  to  space  limitations,  the  risk  levels  for  different  crime  types  is  illustrated  in  Figure 
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A2  in  the  Appendix).  Crime  types  that  may  be  a  part  of  significant  outbreaks  can  be 
considered  as  candidates  for  input  to  the  RFCP  discovery  process. 
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Figure  10:  Results  of  the  RFCP  discovery  process  and  Crime  outbreaks 

In  addition  to  the  crime  types  involved  in  significant  outbreaks,  the  RFCP 


discovery  process  requires  additional  such  as  the  spatial  neighbor  relation  and  an 
interestingness  threshold.  For  discovering  RFCPs  ,  we  used  a  neighborhood  distance  of 
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700  feet  and  an  interestingess  threshold  of  0.001.  The  results  of  the  RFCP  discovery 
process  is  shown  inf  Figure  10.  Figure  10(a)  shows  the  RFCP  corresponding  to  Bars  and 
Aclcohol  crimes.  The  bars  that  were  highlighted  in  Figure  9(b)  appear  again  in  this 
Figure  indicating  that,  the  downtown  bars  may  be  responsible  for  all  the  outbreaks  in 
alcohol  crime.  This  implies  that,  bars  in  Lincoln  have  a  22%  probability  (i.e.  a  value  of 
0.22)  of  leading  to  an  alcohol  outbreak  and  most  of  these  bars  are  localized  in  dowtown 
Lincoln.  Similarly,  Figure  10(b)  shows  the  RFCPs  corresponding  to  Bars  and  Vandalism 
crimes  with  the  downtown  bars  showing  highest  chance  of  leading  (i.e.  0.062  or  6.2  %)  to 
a  Vandalism  outbreak.  Similarly,  Figures  10(b)  and  10(c)  show  a  possible  association 
between  Vandalism  and  Alcohol  crime  outbreaks  particularly  in  the  vicinity  of  downtown 
bars.  While,  the  multinomial  scan  statistic’s  results  illustrated  in  Figure  9  show  an 
indirect  association  between  Vandalism  and  Alcohol,  the  RFCP  analysis  directly  reveals 
a  possible  association  indicates  that  the  highest  chance  of  this  association  is  localized  in 
dowtown  Lincoln. 

4  Emerging  Trends:  Space-time  crime  outbreaks 

Crime  outbreaks  can  also  happen  over  space  and  time.  Crime  pattern  analysis 
literature  has  explored  space-time  hotspots  via  conceptual  constructs  such  as  the  hotspot 
matrix  and  provides  several  useful  suggestions  to  police  for  designing  effective 
mitigation  plans  [62].  A  space-time  outbreak  is  a  similar  notion  but  may  be  defined  over 
multiple  crime  types.  The  SatScan  program’s  multinomial  scan  statistic  allows  for 
detecting  crime  types  that  may  be  a  part  of  outbreaks  over  space  and  time.  To  identify 
such  outbreaks,  SatScan  requires  a  temporal  search  window  for  detecting  space-time 
outbreaks.  Based  on  these  inputs  SatScan  identifies  bar  locations  and  days  at  which  these 
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locations  may  have  crime  outbreaks. 
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Figure  11:  Results  of  space-time  multinomial  scan  statistics  (Best  viewed  in  Color) 


Figure  11  shows  the  result  of  space-time  multinomial  scan  statistics  on  the 
Lincoln  crime  dataset.  The  X-axis  in  Figure  11  shows  different  days  in  the  year  2007. 
These  are  days  that  may  have  one  or  more  crime  outbreaks  as  opposed  other  ordinary 
days  in  the  year  2007.  The  SatScan  program  identified  these  days  based  on  a  temporal 
search  window  input  of  one  day.  The  Y-axis  corresponds  to  crime  types  that  may 
participate  in  one  or  more  outbreaks  on  the  days  shown  in  the  X-axis.  The  color  in  Figure 
11  represents  the  number  of  outbreaks  corresponding  to  different  crime  types.  For 
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example,  there  were  2  outbreaks  of  the  vandalism  crime  on  January  7th  2007.  The  risks  of 
each  crime  type  participating  in  an  outbreak  can  also  be  computed  (shown  in  appendix 
Figure  A. 3). 

The  days  shown  in  the  X-axis  of  Figure  11  may  correspond  to  important  events 
including,  conventions,  football  games  etc.  For  example,  the  day,  15th  September  (09/15) 
corresponds  to  a  Nebraska  Comhuskers  football  game  [45]  and  shows  outbreaks  in  4 
crime  types.  Also,  when  datasets  with  finer  temporal  granularity  (e.g.  time  stamps)  are 
considered,  routine  events  such  as  bar  closing  may  also  lead  to  sudden  increase  in  crime. 
However,  in  order  to  account  for  patterns  in  such  fine  temporal  granularity,  one  may  have 
to  have  to  consider  topologically  rich  space-time  pattern  semantics.  Figure  12  shows  one 
such  spatio-temporal  (ST)  pattern,  Cascading  ST  patterns  [48], 


Figure  12:  Illustrative  ST  crime  dataset  and  cascading  ST  pattern 


CSTPs  represent  partially  ordered  (over  time)  collections  of  spatio-temporal  event 
types  that  are  frequently  associated  with  each  other  in  a  locality  and  occur  in  a  series  of 
stages  over  time.  Figure  12(a)  shows  an  example  of  a  CSTP  from  an  urban  crime  dataset. 
The  first  event  here  is  bar-closings  (represented  by  circles),  and  subsequent  events  are 
assaults  (represented  by  triangles)  and  drunk  driving  (represented  by  squares).  Figures  12 
(b),  (c)  and  (d)  show  individual  instances  of  events  of  bar-closing,  assault  and  drunk 
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driving  with  their  location  and  time.  Figure  12(e)  shows  the  locations  of  all  event 
instances.  When  applied  to  the  Lincoln  crime  dataset,  CSTP  discovery  may  be  able  to 


(a)  Frequency  of  Crimes  after  bar  closing  (b)  CSTP  discovered  from  Lincoln,  NE 

Figure  13:  A  CSTP  from  Lincoln,  NE  ,  2007  Dataset  (Best  viewed  in  color) 

reveal  bar  closing  events  that  frequently  lead  to  crimes  including,  assaults  and  vandalism. 


Discovering  CSTPs  may  help  crime  analysts  generate  hypothesis  about  crime  generators 
and  crime  attractors  [70].  Using  CSTPs,  law  enforcement  can  possibly  find  a  related 
series  of  crimes  and  plan  intervention  strategies  during  a  large  crowd  gathering  (e.g., 
football  games).  In  addition  to  identifying  activation  times  of  potential  crime  generators 
or  attractors,  CSTPs  also  help  understand  appropriate  times  at  which  specific  crime  types 
may  happen  around  such  sources.  For  example,  Figure  13  shows  one  such  CSTP 
discovered  from  Lincoln,  NE.  Figure  13(a)  shows  a  map  of  bars  in  Lincoln,  NE  with  the 
color  representing  the  number  of  bar  closing  events  that  lead  to  an  assault  or  vandalism. 
Figure  13(b)  shows  the  CSTP  corresponding  to  the  map  in  Figure  13(a)  and  lists  the 
chance  of  finding  this  pattern  in  entire  Lincoln  city  and  only  within  downtown.  Not 
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surprisingly,  finding  this  pattern  is  more  likely  in  downtown  Lincoln  rather  than  in  other 
areas  due  to  the  large  number  of  bars  in  the  center. 

5  Research  Needs 

In  this  section,  we  review  some  important  research  needs  that  include 
methodological  advancements  that  may  be  needed  to  effectively  analyze  crime  patterns. 
These  include,  techniques  for  the  detection  of  crime  outbreaks  along  street  networks  and 
outbreak  detection  at  multiple  analysis  scales. 

5.1  Crime  outbreaks  along  street  networks 

Most  existing  methods  for  crime  outbreak  detection  involving  multiple  crime 
types  are  largely  based  on  Euclidean  spatial  neighborhoods.  However,  for  most  practical 
situations  it  may  be  interesting  study  the  outbreak  of  crimes  along  a  street  network. 
Detecting  such  outbreaks  may  provide  insights  to  law  enforcement  analysts  to  identify 
possible  patrolling  districts  after  taking  a  variety  of  other  factors  into  consideration. 
Environmental  criminology  uses  concepts  such  as  Nodes,  paths  and  edges  [11,  23]  that 
may  be  frequently  used  by  offenders  in  their  journey  to  crime.  Identifying  frequent  crime 
routes  taken  by  a  vast  majority  of  offenders  helps  law  enforcement  make  planned 
changes  to  their  monitoring  patterns. 


Figure  14:  Route  level  summarization  of  crime  outbreaks(Best  viewed  in  color) 
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Hence,  a  route  level  summarization  of  crime  outbreaks  may  be  more  intuitive 
compared  to  a  geometric  (e.g.  ellipsoidal  or  circular)  summarization  of  outbreaks.  Figure 
14  shows  the  result  of  this  summarization.  It  is  very  clear  from  Figure  14(b)  that  a 
network  level  summarization  may  be  more  intuitive  as  opposed  to  an  ellipsoidal  scheme 
used  tools  such  as  CrimeStat.  In  this  figure  the  ellipsoidal  scheme  ignores  the  network 
topology  and  clusters  crime  reports  across  the  network.  Using  the  result  of  route 
summarization  in  Figure  14  and  a  variety  of  other  factors,  analysts  may  be  able  identify 
appropriate  patrolling  routes  to  mitigate  crime. 

One  can  hand  map  these  patrol  routes  by  taking  a  variety  of  relevant  factors  into 
consideration.  However,  this  might  require  enormous  human  effort.  Instead,  one  can 
explore  solutions  based  on  SFPM  to  reduce  the  possible  routes  and  pick  the  most  suitable 
patrol  districts  with  aid  of  an  analyst.  Given  a  collection  of  crime  reports,  a  street 
network  and  a  user  specified  parameter  (K),  SFPM  has  explored  techniques  for 
summarizing  crime  reports  along  a  street  network  [56,  58].  However,  these  techniques 
may  have  to  be  revisited  to  account  for  multiple  crime  types  that  may  participate  in 
significant  crime  outbreaks. 

5.2  Outbreak  detection  at  multiple  analysis  scales 

Handling  spatial  scale  has  been  an  open  research  challenge  in  many  GIScience 
applications  [73].  In  crime  outbreak  detection  one  of  they  key  inputs  specified  by  analysts 
is  the  spatial  neighborhood  size.  The  results  of  the  any  analysis  are  sensitive  to  the 
neighborhood  size  specified  by  the  user.  Particularly,  in  the  approach  shown  in  Figure  7, 
the  crime  type  level  counts  are  sensitive  to  the  spatial  neighborhood  size.  Also,  the  RFCP 
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process  requires  a  spatial  neighborhood  size  as  an  input.  This  makes  any  spatial  analysis 
technique  sensitive  to  spatial  scale.  For  example,  Figure  15  shows  a  simple  scenario  for 
detecting  outlier  buildings  from  a  subset  of  the  Lincoln,  NE  dataset  using  their  area 
attribute. 
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Figure  15:  Map  of  two  outlier  buildings  in  Lincoln  crime  dataset  (best  viewed  in  color) 


Figure  15(a)  and  (b)  are  the  analysis  performed  at  different  spatial  scales,  namely, 
two  nearest  neighbors  and  eight  nearest  neighbors  respectively.  Outlier  analysis  using  the 
first  scale,  two  nearest  neighbors,  highlights  the  building  B1  as  anomalous  (Figure  15(a)), 
whereas,  when  we  increase  the  scale  of  analysis,  building  B2  is  flagged  as  anomalous 
(see  Figure  15(b)).  New  techniques  are  needed  that  can  perform  SFPM  at  multiple 
analysis  scales. 

New  research  is  also  needed  to  explore  the  use  of  frequent  patterns  such  as  CSTPs 
to  drive  models  that  can  predict  future  crime.  With  the  recent  interest  in  predictive 
policing,  pursuing  this  direction  may  help  in  enhancing  intervention  strategies  via 
effective  preparedness  [37] 
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6  Conclusions 


This  chapter  explored  Spatial  Frequent  Pattern  Mining  (SFPM),  which  is  a  data- 
driven  approach  to  crime  pattern  analysis.  We  identified  the  benefits  of  data  driven 
approaches  in  the  face  of  large  spatio-temporal  crime  datasets  and  highlighted  that  they 
are  useful  in  reducing  human  effort.  Hypotheses  regarding  real  world  phenomena 
pertaining  to  crime  can  be  generated  only  after  analysts  have  evaluated  the  results  of  the 
SFPM  process.  Hence,  SFPM  simply  reduces  the  effort  an  analyst  might  have  to 
undertake  to  formulate  a  meaningful  hypothesis  regarding  the  nature  of  crime  patterns. 
Pressing  research  needs,  including  new  SFPM  methods  for  outbreak  detection  that 
account  for  crime  distributions  along  street  networks  and  analysis  across  multiple  scales 
were  identified  with  specific  examples. 
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Appendix 

I  Spatial  crime  outbreak  (additional  types) 
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Figure  A.l:  Significant  crime  type  outbreaks 


37 


Figure  A.  1  shows  additional  crime  type  outbreaks  in  the  vicinity  of  bars  in  Lincoln,  NE 
during  the  year  2007. 


Risk  of  outbreak  from  a  Crime  type 

Bribery 

o 

Extortion 

o 

Reed  v  e&lole  nProper  ty 

0 

Alcohol 

o 

Assault 

o 

Escapee-LPD 

o 

Narcotics 

o 

LoaLltem 

o 

Traffic 

o 

Kidnapping 

o 

Pornography 

o 

False- Information 

o 

Escapee 

0 

Juvenile  Crime 

o 

Robbery 

o 

Bomb 

o 

Weapons 

o 

AuloTben-UnauIhUse-MV 

o 

Forgery 

o 

Embezzlement 

o 

Arson 

o 

Fraud 

o 

Disturbance 

o 

Sox -Offense 

o 

Larceny 

o 

Prowler 

o 

Vandalism 

o 

Domestic-Disturbance 

o 

T  resspassing 

o 

Juvenile-Missing 

o 

Abuse 

c 

Burglary 

o 

Telephone 

o 

1  1  1  1 

0  50  100  150 

Average  risk  of  Outbreak 

Figure  A.2:  Average  Risk  of  a  crime  type  being  within  any  outbreak 
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II  Space-time  crime  outbreak 


Average  risk  of  outbreak  by  crime  type  over  days  (2007) 
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Figure  16:  Average  risk  of  crime  type  participating  in  an  outbreak 
(Best  viewed  in  color,  Log2(Average  Risk  )  is  shown) 
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